能否在Spring新RestClient中实现OAuth2认证？

完全可以把这套OAuth2认证逻辑适配到Spring 6+推出的RestClient上，Spring提供了对应的拦截器来实现类似WebClient的认证能力，配置方案如下：

1. 配置带OAuth2认证的RestClient #

@Bean
RestClient restClient(OAuth2AuthorizedClientManager authorizedClientManager) {
    // 创建OAuth2请求拦截器，对应WebClient的ServletOAuth2AuthorizedClientExchangeFilterFunction
    OAuth2AuthorizedClientHttpRequestInterceptor oauth2Interceptor = 
        new OAuth2AuthorizedClientHttpRequestInterceptor(authorizedClientManager);
    // 设置默认使用已授权的客户端，和WebClient的setDefaultOAuth2AuthorizedClient(true)效果一致
    oauth2Interceptor.setDefaultOAuth2AuthorizedClient(true);

    return RestClient.builder()
        .baseUrl("http://127.0.0.1:8091")
        .requestInterceptor(oauth2Interceptor) // 添加OAuth2认证拦截器
        .build();
}

2. 复用原有OAuth2授权管理配置 #

你之前定义的authorizedClientManager Bean可以直接复用，不需要做任何修改，它依然负责处理客户端凭证、授权码、刷新令牌等全流程的OAuth2授权管理：

@Bean
OAuth2AuthorizedClientManager authorizedClientManager(
      ClientRegistrationRepository clientRegistrationRepository,
      OAuth2AuthorizedClientRepository authorizedClientRepository) {

OAuth2AuthorizedClientProvider authorizedClientProvider =
      OAuth2AuthorizedClientProviderBuilder.builder()
        .clientCredentials()
        .authorizationCode()
        .refreshToken()
        .build();

DefaultOAuth2AuthorizedClientManager authorizedClientManager =
     new DefaultOAuth2AuthorizedClientManager(
       clientRegistrationRepository, authorizedClientRepository);

authorizedClientManager.setAuthorizedClientProvider(authorizedClientProvider);

return authorizedClientManager;
}

3. 适配接口代理（如果需要生成UserClient） #

如果要像WebClient那样通过HttpServiceProxyFactory生成UserClient接口代理，只需把RestClient适配为对应的客户端适配器即可：

@Bean
UserClient userClient(RestClient restClient) {
    RestClientAdapter adapter = RestClientAdapter.create(restClient);
    HttpServiceProxyFactory factory = HttpServiceProxyFactory.builderFor(adapter).build();
    return factory.createClient(UserClient.class);
}

关键差异说明 #

• RestClient通过requestInterceptor添加OAuth2认证逻辑，替代了WebClient的apply(oauth2.oauth2Configuration())配置方式
• OAuth2AuthorizedClientHttpRequestInterceptor和WebClient的过滤器作用完全一致，会自动获取并添加Bearer令牌到请求头
• 所有OAuth2客户端注册、授权管理的核心逻辑都可以复用，无需重新开发

内容的提问来源于stack exchange，提问作者Willy De Keyser